fix(alerts): resolve last-event grouping and document its rollout

[rvald26]

The alert plugin receives events[] on the wire but queries documents indexed with lastEvent. Directly looking up lastEvent on the wire drops those grouping keys. This draft resolves values from the final wire event while retaining the indexed query paths, and shares query-term construction between grouping and deduplication. Non-scalar or missing values cannot trigger a name-only search.

This is a runtime grouping change across technologies. A reproducible inventory pinned to v11 commit 660c796f168670fd6ccb079995c09c46d4f0068d identifies 231 rule files with lastEvent keys (309 occurrences, 126 distinct paths), plus all other configured grouping keys. These are potential query changes, not 231 proven live activations. See plugins/alerts/audits/grouping-rollout.md for the separate pending rollout plan.

Tests use real SDK alerts and BoolBuilder terms to verify final-event values, indexed lastEvent paths, array selectors, .keyword suffix handling, numeric zero/boolean false and missing/non-scalar values. The full alerts module passes locally. Query tests do not contact customer indices or prove deployed index mapping behavior.

The reusable filter contract harness remains included as a separate testing facility. It decodes against pinned go-sdk v1.1.31 and evaluates real CEL. Synthetic normalization is explicitly labeled. New opt-in raw JSON fixtures use SDK key sanitization and reject unsupported executed parser/functions; this is an offline model, not the closed EventProcessor. Optional all-branch placeholder checks do not execute history searches. A fixture without rule assertions proves no detection.

Before rollout: compare the same ordered stream against equivalent isolated alert indices, measure per-rule candidate/saved/suppressed/parent counts, inspect partial/missing identities and active deployed rule/mapping versions, and approve expected changes. These staging and volume checks remain pending. Technology drafts using lastEvent grouping depend on this runtime fix.

Draft only, targeting official utmstack/UTMStack v11. No customer writes, deployment, merge, auto-merge or SOC messages were performed.